In this lecture, we learn how to get the credentials of a victim using the beef product, in the last
lecture you saw the installation of the beef framework and in this lecture will actually start learning
the practicals.
So let us get started.
I have loved listening to my colleague the next that I'm going to do this, I'm going to terminate and
then I'm going to launch the B project launch to be project go to the directory where you have installed
the B project.
I have installed beef in the application section before I will go to Beef Ellis' and I will launch and
be launched beef type as you and hit and it will ask for your password and the password of the Cali
machine and not the legal framework into the password for that is your you get your virtual machine
and type dot slash beef.
Please wait till the beef framework starts.
It will take a couple of minutes to start the beef framework.
I've gotten out of that beef is already running.
So, yes, my beef is already running, but I have shown you how to log on to beef, take the euro with
the IP address of your Cali machine, then go to Firefox.
After going to Firefox's type the euro and hit enter, he will get the beef login page, log in to beef
with the password.
I have changed the password to add been one to three and password to password.
One, two, three.
You can see I have successfully logged into the framework, the next thing that we are going to do is
we are going to hook someone.
So copy the hook you all into a text editor so that it will become easier for you to write code.
Now, to hook someone, we need to give the user that you are in.
So either way of doing that is by your exploiting the excess vulnerability or by directly sending the
link to someone.
So no, I will just write.
So we have to write the you are in the script form so that it will get executed on the Exodus page in
the den when they will have application.
So we write script source and in the source section we have to copy that website.
I will copy the website of Hook.
That is the hook you Worrill.
And then I will paste into the source section.
I'm doing this because I'm going to explode the page were in my victim, which will be myself.
I am going to act the victim and the attacker at the same time for the demonstration purposes.
But your job is to just stay the hope you are to someone to hook their browser.
Well, they're using the browser,
so.
To explode excesses when the reality will first need to start to dampen the rebels web application to
start a TV WTG, we need browser and we need to start the party service as well as the my skills of
this.
That is the Bob, and I'm just randomly going out here on this college website and now someone wants
to hook me, so I'll try just pasting that website.
That is the hook.
You are a.
Sudo.
So this Apache start to start the Apache Sova.
Into the password for the machine.
And Sudo.
So was my school start.
Which will start the database for them when the rehabilitative application.
Now, let us go to Firefox's and take the default password that is one twenty seven point zero point
zero debatably for this lecture, we are going to use the WWE, which is already installed in the Karley
machine and not demitasse MLO.
So first thing is to set up the security to look, that is if that script gets executed here.
Right now, the security of this is impossible.
So we'll just see if it gets executed here.
It is copy this script.
And then pasted into the name and let's see if it gets executed or not.
Yes, my name is getting cuter now what I do, I replaced my name with the script and then I hit and
you can see my browser has been hooked into the beef because the link got executed.
And by executing the link in the memorial means that I have click the link so you can see that a lot
of plugins ins go to social engineering, petty theft, that is theft of the credentials will keep dialogued.
I Facebook, Google agree and in the customer will let it be the logo and click execute NALGO to that
browser and see what I've got.
Vola.
I got a dialog box saying that your station has been timed out and it's prompting me to enter my password.
So I'm a victim and I, I will believe that my decision has been timed out.
I will enter the password.
I will not bother to read one, two, three and I will get into some real Facebook password believing
that OK.
Oh, let's see my Facebook account and login again and I login.
Let's go to beef now.
What we have got on the command.
Vola, we've got the password.
We have literally got the password and the victim got tricked easily, the victim didn't check the wall,
it was in front of it.
Now, I will again execute another very well in beef.
So what I'll do is I'll you your job is just to say that you are alleged to be the address of your caliber
machine and then the hook Dargis.
So we'll execute Firefox or blogging, saying that there is some element that needs to be downloaded
for the speech and in the blogging you all, I will give a malicious you word in this example.
I am giving w w w dot Google dot com.
But but a real hacker would give a malicious.
You are there so I will click execute and now I will go to my box.
Vola got a plug in as and as a normal user who does not have the knowledge of that.
She will just really click it.
And now you can see I might add, my page got redirected to Google dot com.
So this is how hackers use this framework.
This is a part of free market is not only used for social engineering, but it has also got many other
components as well.
So I will execute another one to test whether it has got anything and not there are no Velzy players
detected on my screen.
So moving in this way, I will again choose to view the toolbar one to see whether there are any toolbars.
This is the Jimmy Page and literally everything is available on the beef framework.
And that is why it is considered as one of the most powerful frameworks for social engineering attacks,
cross scripting attacks, Crossette request, forgery attacks and many more.
So there are no toolbelt rejected because this browser hasn't got any more toolbars and there is no
bookmarks out there.
So yes, this is actually a pretty decent tool to carry out attacks.
But again, there is a warning from Instructables that please do not use this tool for illegal purposes
as the instructors and the platform is not responsible if you get compromised into any legal action.
These videos are only for educational purposes to understand to tell you that how hackers can trick
a normal person.
Now, I will try a lingling petty theft when I click execute to the browser who is hooked now and then
you get the notification.
Now, here I am getting the notification because in the full OLAP case, I am the one who is acting
like a victim and attacker itself.
But in real life attackers then that hook you all via different sources and they hook different people
to the B framework and that is how they execute.
The main job is the delivery of that you warrant, which is really very difficult and common people
get easily tricked into that.
So as a security expert, you should not click any random email that random websites and even your browser
may get hooked to the B framework.
So this was all our B framework for social engineering.
If you want to learn the framework, you can try and see how it works.
There are really a lot of plugins available there.
So but make sure that you do not use be for malicious purposes.